Every run acts under a named person's re-checked authority

Context

Background work needs a named accountable person whose grants are still valid when work executes. Recurrence and batch processing check authority at their respective boundaries.

Decision

The requester supplies preparation attribution, the starter supplies execution attribution, and recurring occurrences use their owner. Workers re-resolve grants for the batch they are about to handle.

Alternatives Considered

System identity and start-only checking weaken accountability and grant withdrawal. The current engine does not adopt either option.

Consequences

Revocation stops subsequent work without reversing earlier effects. Notice populations use saved-query visibility, but installment populations use direct unit-scoped selection; Product must decide whether that difference is intended.